helgesverre/toon

Documentation and release notes are strong, and the repository shows recent multi-contributor activity. The single publisher, concentrated commits, missing security policy, and unpinned workflow actions leave modest continuity and build-integrity concerns.

Latest v3.2.1

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Maintainers

Only one registry publishing account is listed. The linked repository is user-owned rather than organization-owned, so there is limited visible publishing redundancy.

Repo bus factor

Although 4 contributors were active, one contributor made about 89% of recent commits, leaving maintenance substantially dependent on one person.

Security policy

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent despite the presence of security scanning tooling.

Workflow audit

Both workflows were analyzed without high-confidence audit findings or untrusted triggers, but all 12 action references are unpinned, so workflow dependencies can change unexpectedly.